I have users belongs to specific realm (let say) RealmA. Now I would like to create RealmB, and add 2FA authentication for all users in this RealmB.
I know, that I can duplicate current Browser flow, add specific step (OTP) and set it as default browser flow. But this will change browser flow for all users/realms.
Can I just do it for specific realm/users group?
If yes, how?
I see, Conditional OTP, but how can I do this?
Any hint, documentation or tutorial is welcome!
In Keycloak 24.0.2-0 (the specific version I tested this on), it is sufficient to just enable and set as default action, the Configure OTP option in the “Required actions” tab in the “Authentication” menu.
No browser flow modification was needed.
If you do not set it as default action, then it is upto each individual user to set it up for themselves.
They can do it from their account page.
Generally the url is:
https://localhost:8443/realms/<REALM_NAME>/account/#/
Ofcourse, substitue localhost:8443 with the actual url of the keycloak instance.
2